analyzing-bootkit-and-rootkit-samples

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs the agent to run privileged disk and firmware operations (dd, mount EFI, chipsec, flashrom) and even recommends reflashing firmware and rebuilding the ESP, which require root and can modify/compromise the host state.